-
Notifications
You must be signed in to change notification settings - Fork 14
Description
Hi, very usefull module.
At the moment I come acress a lot of spam using Cloudflare's shortener urly.fi
Esample from a spam mail: https://urly.fi/1cAF
When accessed manually thought openssl I get a result:
$ openssl s_client -connect urly.fi:443 -servername urly.fi
[...]
GET /1cAF HTTP/1.0
Host: urly.fi
HTTP/1.1 301 MOVED PERMANENTLY
Date: Fri, 17 May 2019 13:40:58 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: __cfduid=d2d87edbcdde7c2e41c88b24941f433d01558100458; expires=Sat, 16-May-20 13:40:58 GMT; path=/; domain=.urly.fi; HttpOnly
Location: https://besthotvalentines.com/qjqumernhzkmksy?t=goam
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Server: cloudflare
CF-RAY: 4d8601770ad0cc36-ZRH
But when I look at the debug output of SpamAssassin firing this module:
May 17 15:54:17.940 [11506] dbg: DecodeShortURLs: URL is not redirect: https://urly.fi/1cAF = 403 Forbidden
So I wonder where this 403 forbidden comes from. Does CloudFlare recognize the 'LWP' User agent and distrusts it? Is it a https problem?
-Benoît-